Detecting mobile telephone misuse

ABSTRACT

An arrangement for the detection of fraudulent use of a telephone subscriber&#39;s instrument in a mobile telephone system includes an input preprocessor (110), a neural network engine (111) coupled to the preprocessor, and an output postprocessor (112) coupled to the neural network engine. The preprocessor determines for each subscriber a first long term calling profile, a second short term calling profile, and a subscriber profile pattern comprising the difference between the first and second profiles. Each calling profile and subscriber profile pattern comprises a set of values for a respective set of call attributes. The neural network engine comprises a self organizing map trained to effect pattern recognition of the subscriber profile patterns and a multilayer perceptron adapted to determine for each recognized pattern a value indicative of the probability of a fraud being associated with that pattern.

This invention relates to an apparatus and method for the detection offraudulent use of mobile telephones.

BACKGROUND OF THE INVENTION

Mobile telephone fraud is the unauthorised use of a telecommunicationsnetwork accomplished by deception via the wireless medium. Thisdeception may take a number of forms which are generally classifiedunder the broad headings of subscription fraud, theft and cloning.

Subscription fraud arises from the use of a false name and address whenpurchasing a mobile telephone and results in a direct loss to theservice provider when a bill for usage of the telephone is unpaid.

Theft of a mobile telephone can lead to antenna misuse in the periodbetween loss of the telephone and the reporting of that loss to theservice provider. In some circumstances a mobile telephone may simply beborrowed by a fraudster who then steals air time. This particular typeof theft may remain undetected for some time as it will become apparentonly when the customer subsequently receives a bill.

The most serious fraud in a mobile system is that of mobile telephonecloning where the fraudster gains access to the network by emulating orcopying the identification code of a genuine mobile telephone. Thisresults in multiple occurrence of the telephone unit. The users of theseclones may or may not be aware of this misuse. This fraud generallyremains undetected until a customer becomes aware of unexpected items ona bill, by which time the total financial loss can be substantial.

Approaches to the problem of detecting mobile telephone fraud aredescribed in specification No WO-A1-95/01707 and in specification NoWO-A1-94/11959 both of which refer to techniques for building up anhistorical profile of subscriber activity so as to detect changes inthat activity which may be indicative of fraudulent use.

Once illegal access has been gained to the mobile network, calls can bemade at no cost to a fraudster, as either a genuine account holder isbilled or the network provider is forced to write off the cost. It willbe appreciated that once an identification code has been broken and atelephone has been cloned, this information can be disseminated to otherfraudsters resulting in a high potential financial loss. The relativelyslow response of conventional fraud detection procedures has becomeinsufficient to address the rapid incidence of abuse of the system. Itwill also be appreciated that new forms of fraud are constantly comingto light and that these may not be immediately detectable byconventional techniques.

An object of the invention is to minimise or to overcome thisdisadvantage.

It is a further object of the invention to provide an improved apparatusand method for the detection of fraudulent use of a mobile telephonesystem.

SUMMARY OF THE INVENTION

According to one aspect of the invention there is provided an apparatusfor the detection of fraudulent use of a telephone subscriber'sinstrument in a mobile telephone system, the apparatus including meansfor determining a long term calling profile for a said subscriber, meansfor determining a short term calling profile for the subscriber, meansfor determining the difference between the long term and short termprofiles, said difference comprising a subscriber profile pattern, and atrained neural net arrangement for determining from the subscriberprofile pattern a probability value for the existence of fraud in thatpattern, wherein the neural net arrangement comprises a self organisingmap adapted to effect pattern recognition of said subscriber profilepatterns, and a multilayer perceptron adapted to determine saidprobability value for each recognised pattern.

According to another aspect of the invention there is provided apparatusfor the detection of fraudulent use of a telephone subscriber'sinstrument in a mobile telephone system, the apparatus including aninput preprocessor, a neural network engine coupled to the preprocessor,and an output postprocessor coupled to the neural network engine,wherein the preprocessor is adapted to determine for each subscriber,from that subscriber's telephone call data, a first long term callingprofile, a second short term calling profile, and a subscriber profilepattern comprising the difference between the first and second profiles,each said calling profile and subscriber profile pattern comprising aset of values for a respective set of call attributes, wherein theneural network engine comprises a self organising map trained to effectpattern recognition of said subscriber profile patterns and a multilayerperceptron adapted to determine for each recognised pattern a valueindicative of the probability of a fraud being associated with thatpattern, and wherein said postprocessor is arranged to order saidrecognised pattern according to said fraud probabilities.

According to a further aspect of the invention there is provided amethod for the detection of fraudulent use of a telephone subscriber'sinstrument in a mobile telephone system, the method includingdetermining a long term calling profile for a said subscriber,determining a short term calling profile for the subscriber, determiningthe difference between the long term and short term profiles, saiddifference comprising a subscriber profile pattern, and processing thepattern via a trained neural net arrangement comprising a selforganising map adapted to effect pattern recognition of said subscriberprofile patterns and a multilayer perceptron adapted to determine saidprobability value for each recognised pattern whereby to determine fromthe subscriber profile pattern a probability value for the existence offraud in that pattern.

BRIEF DESCRIPTION OF THE DRAWINGS

An embodiment of the invention will now be described with reference tothe accompanying drawings in which:

FIG. 1 is a general schematic diagram of an arrangement for thedetection of fraudulent use of a mobile telephone system;

FIG. 2 shows the general construction of a preprocessor for use in thearrangement of FIG. 1;

FIGS. 3a and 3b show respectively a typical user profile and acorresponding profile pattern determined by the processor of FIG. 2;

FIGS. 4a and 4b illustrate the effect of applying transformations to theprofile pattern of FIG. 3b;

FIGS. 5a to 5c illustrate the generation of a customer profile fromhistorical and recent customer data;

FIG. 6 shows the construction of a neural network engine for use in thearrangement of FIG. 1;

FIG. 7 illustrates the SOM neural network architecture of the neuralnetwork engine of FIG. 6;

FIG. 8 illustrates the MLP neural network architecture of the neuralnetwork engine of FIG. 6;

FIG. 9 shows a postprocessor for use in the arrangement of FIG. 1; and

FIG. 10 illustrates clustering of SOM profiles derived from the SOMneural network.

DESCRIPTION OF PREFERRED EMBODIMENT

Referring to FIG. 1, the arrangement includes a processor generallyindicated as 11 accessed via a user interface 12. The processor receivescustomers detail records 13 of calls made by customers and outputs alist of potential frauds 14 by processing and analysis of those records.As shown in FIG. 1, the processor 11 includes a preprocessor 110 whichgenerates customer profiles 15 from the input customer data, a neuralnetwork engine 111 which performs the customer profile analysis and apost processor 112 which performs an output function.

The neural network engine 111 may incorporate a self organising map(SOM), which organises customer calling patterns into groups, and amulti-layered perceptron (MLP) which is trained to recognise potentialfrauds in the customer calling patterns from known cases of fraud.

Referring now to FIG. 2, this shows the construction of the preprocessorof the arrangement of FIG. 1. The function of the preprocessor is totransform the new data relating to customer calls into a format suitablefor processing by the neural network engine. The preprocessor is alsoused to process information from a training file 21 into a form suitablefor training the MLP.

The output of the preprocessor comprises SOM profiles 22 for the selforganising map, MLP detection profiles 23 for the multi-layer perceptron(MLP) and training profiles 24 for the MLP.

A customer detail record is a log of a completed telephone call. Thiscomprises a number of attributes, for example the following:

Billing account number.

Telephone number associated with account.

Called telephone number.

Date and time of completion of call

Duration of call.

Originating send area.

Receiving area.

Home location of the caller.

Medium of call destination i.e. land, mobile or call forward.

Units of call.

Call made to a frequently used telephone number

Distance class of call

The preprocessor collects the individual CDR's for each customer andgenerates a customer profile record. A profile record captures acustomer's calling pattern over time and is created for each customeraccount holder from their respective CDR's. Typically a customer'sprofile record comprises the following attributes or fields:

1. The time span over which the profile has been created.

2. The percentage of local calls.

3. The percentage of national calls.

4. The percentage of international calls.

5. The proportion of calls which are made to regularly used telephonenumbers.

6. The number of units used.

7. The total number of calls made over a given period of time.

8. The average duration of a telephone conversation.

9. The proportion of calls made to other mobile phones as opposed toland destinations.

10. The proportion of calls which originate in the local area of thephone against those made in other districts.

11. The variation in different originating calls. This is a measurementof the number of different districts used to initiate calls.

There are two types of customer or user account profiles, an historicprofile and a new profile. The historic profile captures the customer'scalling behaviour over a long period of time, typically six months. Itis assumed that fraudulent activity is not taking place for eachhistorical profile during that period. Calling habits can change overtime and the historical profile will thus need to be updatedperiodically to reflect the new calling behaviour.

The new profile models the account holder's more recent callingbehaviour. The time period could range from a matter of hours up toweeks. FIG. 3a shows a typical customer profile. The profile attributeshave been normalised to values between 0-1. A profile pattern is thenobtained by plotting the points of the profile for each attribute, asillustrated in FIG. 3b which shows the pattern obtained from the profileof FIG. 3a.

The output file does not have to include all the fields described aboveand for some applications may consist of a subset of the fieldsidentified in the profile record. All the fields are numeric and may besubjected to mathematical transformations. Transformations alter thecharacteristics of a field and are used to improve the patternrecognition capabilities of the neural network by accentuating salientfeatures. There are many functions which are suitable for this task.

Transformations can be applied globally to change all the fields orlocally to make one attribute more or less predominant. FIGS. 4a and 4billustrate the effects of applying local and global transformations toattributes or fields of the pattern of FIG. 3b.

As discussed above, the processor uses the historic and new profiles togenerate SOM profiles and MLP profiles.

A SOM profile is a measure of the change in behaviour of a user'scalling habits. This is the difference between the historical profileand the new profile. Scaling may take place between the historical andnew profile to produce a more pronounced output pattern. This may beused to improve the pattern recognition capabilities of the neuralnetwork, and is illustrated in FIGS. 5a to 5c which illustrate thederivation of a SOM profile from corresponding historical and newprofiles for a customer.

An MLP profile for detection is a set or pair of historical and newprofiles for a particular customer. An MLP profile for training issimply an MLP profile for detection with the inclusion of an extrabinary field for each profile which indicates whether or not a fraud isbeing committed in that particular profile. A binary `1` denotesfraudulent activity otherwise the value will be `0`.

Referring now to FIG. 6, the neural network engine incorporates aself-organising map (SOM) 61 and a multi-layer perceptron (MLP) 62 eachhaving a respective definition module 611, 621. SOM profiles 22 from thepreprocessor are fed to the SOM 61. MLP detection profiles 23 and MLPtraining profiles 24 are fed to the MLP 62.

The neural network engine is a tool which recognises patterns of fraudfrom a set of account or customer profiles. The pattern recognitioncapabilities are determined by the architecture and input data.

The SOM 61 is a neural network architecture which discovers patterns indata by clustering similar types together. The data is grouped by theSOM without any prior knowledge or assistance which makes the types ofpatterns found highly dependent upon the input data presented. The SOMis used to classify the SOM profiles into groups representing types oflegitimate and fraudulent patterns. Grouping is achieved by mapping theprofiles on to points on a two dimensional plane, each pointrepresenting a group. A SOM is topology preserving which meansneighbouring groups will share similar features.

The SOM operates in two phases, firstly the neural network learns thecharacteristics of the data upon which the model the groups. This isachieved by repeatedly presenting the set of profiles to the networkuntil the classification of profiles to groups remains static. Thenumber of potential groups is predetermined and reflects the diversityin the data. This is the training phase of the SOM. Once the group typeshave been established, unseen profiles can be presented to the networkand will be classified accordingly. Each profile will be allocated tothe group which it most closely resembles.

SOM Input

In both the learning and classifying stages the same type of input isused and comprises a set of SOM profiles from the preprocessor.

Although the network operates on unlabelled data some prior knowledge ofcases of fraud is beneficial to assist in interpreting the data andoptimising the pattern recognition capabilities. Table 1 below shows aSOM profile which is a set of user account profiles where #n denotes thefield or attribute number.

                  TABLE 1                                                         ______________________________________                                        SOM Profile                                                                   #1   #2     #3     #4  #5   #6   #7   #8  #9   #10  #11                       ______________________________________                                        0.4  0.67   0.6    6   2.5  0.9  0.56  5  2    0.7  11                        0.5  0.9    0.56   3   4    0.8  0.2   1  3    0.1  10                        0.1  0.7    0.1    1   9    0.34 0.76 18  3    0.56 14                        0.3  0.2    0.3    7   1    0.2  0.3   4  2    0.2  12                        ______________________________________                                    

SOM Output

The groups are represented by points in two-dimensional space. Eachgroup will also have a set of characteristics associated with them thatdescribe the group. The characteristics comprise the profile associatedwith that group. The output consists of the allocation of profiles togroups where each profile belongs to precisely one group. This isillustrated in Table 2 below and in FIG. 7 which shows the SOM neuralnetwork architecture in highly schematic form.

                  TABLE 2                                                         ______________________________________                                        SOM Output                                                                    SOM Profile Group          Group Profile                                      ______________________________________                                        0.56 0.34 . . .                                                                           00010000       0.54 0.3 . . .                                     0.4 0.2 . . .                                                                             10000000       0.34 0.2 . . .                                     0.7 0.4 . . .                                                                             00000001       0.9 0.5 . . .                                      0.3 0.4     01000000       0.23 0.44 . . .                                    ______________________________________                                    

In FIG. 7, the two dimensional plane represents the output space of thenetwork where the groups are depicted by nodes. The SOM profile input isfed into the network and allotted to the output node it most resembles.The black node in FIG. 7 denotes the group type of the SOM profile. Thegroups characteristics are stored on the connections from the SOMprofile to the Output Plane as indicated by the black dots.

The multi-layer perceptron (MLP) is used to give an indication of thelikelihood of fraud occurring for each accounts holder or customer. Themulti-layered perceptron is trained to recognise patterns fromhistorical data containing known cases of fraud. Training is defined asshowing the neural network a set of MLP profiles for training whichincludes the desired response of either legitimate or fraudulent. Oncetrained the neural network can then interpolate over unseen data.

The MLP has three modes of operation training, validation and detectioneach of which are discussed below.

Training is the process of teaching the neural network to recognisepatterns. During this phase each profile is shown in turn to the neuralnetwork along with the desired response. For training we need data thatwe know about. We also need a large representative set of data to ensurethat the neural network learns all the possible patterns. The process isrepeated until the neural network has been successfully taught, thisbeing measured by the amount of error between the neural network outputand the desired response.

Validation is the process of checking that the neural network haslearned successfully. Validation is much like training, but here thenetwork is tested on previously unseen data where the desired responseis already known to see how well the network has generalised. Ifvalidation fails the neural network must be retrained.

Once the MLP has been successfully trained it can then be used in adetection mode on unseen data to judge whether fraud is occurring for anaccount.

FIG. 8 shows the neural network architecture of the MLP. The networktakes either the MLP profile for training or an MLP profile fordetection depending on the mode of operations. The output is acontinuous value between 0-1 which is an indication of legitimate use orof fraud.

MLP Input

The input data for the MLP is a set of MLP profiles supplied by thepreprocessor. In training and validation mode each record contains anadditional field with the desired result. This extra field is a binaryvalue where `1` denotes a fraudulent profile otherwise the value is `0`.This additional requirement is reflected in the MLP profile fortraining. Typical MLP training and detection profiles are illustrated inTables 3 and 4 respectively.

                  TABLE 3                                                         ______________________________________                                        MLP Profile for Training                                                      Historical Profile                                                                           New Profile                                                                             Fraud Indication                                     ______________________________________                                        0.5 0.4 . . .  0.4 0.3 . . .                                                                           0                                                    0.1 0.1 . . .  0.9 0.8 . . .                                                                           1                                                    0.2 0.5 . . .  0.3 0.45 . . .                                                                          0                                                    0.1 0.5 . . .  0.2 0.4 . . .                                                                           0                                                    ______________________________________                                    

                  TABLE 4                                                         ______________________________________                                        MLP Profile for Detection                                                     Historical Profile   New Profile                                              ______________________________________                                        0.5 0.4 . . .        0.4 0.3 . . .                                            0.1 0.1 . . .        0.9 0.8 . . .                                            0.2 0.5 . . .        0.3 0.45 . . .                                           0.1 0.5 . . .        0.2 0.4 . . .                                            ______________________________________                                    

MLP Output

The MLP output from the MLP network is a string of continuous valuednumbers between `0` and `1`. Each number represents the likelihood ofnetwork abuse or fraud for the corresponding account holder. The closerthe value is to `1` the stronger the indication of fraud. In trainingand validation mode the additional binary field containing the actualvalue will also be output to enable the performance to be evaluated. TheMLP training output is illustrated in Table 5 and the detection outputin Table 6.

                  TABLE 5                                                         ______________________________________                                        MLP Output for Training                                                       ACTUAL RESPONSE                                                                              DESIRED RESPONSE                                               ______________________________________                                        0.8            1                                                              0.1            0                                                              0.4            0                                                              0.7            1                                                              ______________________________________                                    

                  TABLE 6                                                         ______________________________________                                        Output for Detection                                                          ACTUAL RESPONSE                                                               ______________________________________                                        0.8                                                                           0.1                                                                           0.4                                                                           0.7                                                                           ______________________________________                                    

The postprocessor shown in FIG. 9 provides the intermediary stagebetween neural network and the user interface. Its purpose is totranslate the neural networks output into a meaningful and usefulformat. The postprocessing tasks include merging data from profiles,reversing mathematical functions applied by the preprocessor, sorting,filtering and saving the results to file.

Self Organising Map (SOM)

The SOM network clusters profiles of user accounts into groups in twodimensional space. This concept is illustrated in FIG. 10 in which theblack circles represent group types and the grey dots denote thecustomer account profiles. A customer account profile will belong to thenearest group in the 2-Dimensional space, group boundaries are shown bythe dotted lines. The output comprises the SOM profile and theirassociated group type as well as the characteristics of that group. Fromthe group characteristics we can measure how closely the SOM profilematches that group. This measure serves as a certainty factor for groupswhich are found to be fraudulent. The output is merged with the user'sbilling account number to retain user details. The user account profilesare then listed by their group type and certainty factor within thatgroup as illustrated in Table 7 below:

                  TABLE 7                                                         ______________________________________                                        Postprocessed SOM Output                                                      Billing Account No                                                                            Certainty Factor                                              ______________________________________                                        GROUP A                                                                       001             0.98                                                          002             0.9                                                           003             0.78                                                          004             0.72                                                          005             0.69                                                          GROUP B                                                                       006             0.94                                                          ______________________________________                                    

The task is now to label groups in terms of legitimate accounts andtypes of fraud. One technique for identifying group types is to addprofiles of known legitimate and fraudulent types to the input space.The resulting group can then be labelled accordingly. Unknown groups mayrepresent new types of fraud. Once the data has been labelled the outputcan be used for fraud detection. Here, only fraudulent cases need to belisted. This list can then be saved to file.

Multi-Layered Perceptron (MLP)

The MLP network operates in training, validation or detection mode. Intraining or validation mode the neural network output is a set of actualand desired values. The actual values are calculated by the neuralnetwork and represent the degree of certainty of fraud occurring forthat account holder. These are continuous values between `0` and `1`.The desired value is a binary value where `1` denotes fraud otherwise itis `0`. The output is used as a performance measure to judge how wellthe neural network has learned to recognise fraud. The performancemeasure is calculated from the average difference between actual anddesired values. An acceptable error threshold needs to be set and if themeasure falls outside this value then the neural network has not beentrained successfully. The neural network should be validated on a set ofdata which is independent from the training set to test thegeneralisation capabilities. Table 8 below illustrates the calculationof the perceptron metric.

                  TABLE 8                                                         ______________________________________                                        Performance Metric                                                            Actual Value                                                                              Desired Values                                                                           Difference                                             ______________________________________                                        x.sub.1     y.sub.1    y.sub.1 - x.sub.1                                      x.sub.2     y.sub.2    y.sub.2 - x.sub.2                                      •     •    •                                                •     •    •                                                x.sub.n     y.sub.n    y.sub.n - x.sub.n                                                             1 #STR1##                                              ______________________________________                                    

Once the network has been successfully trained it can be used indetection mode. The output now contains the set of actual values. Theseactual values need to be merged with their corresponding user billingaccount number prior to processing to ensure the reference to theoriginal users details is retained. The account profile can then beordered in a list by the strength of the indication of fraud. Athreshold can be optionally used to filter out less prevalent cases.Items at the top of the list should have highest priority for furtherinvestigation. This list can then be saved to file. An example of thelist is given in Table 9.

                  TABLE 9                                                         ______________________________________                                        Postprocessed MLP Detection Output                                            Bill Account No                                                                              Certainty Factor                                               ______________________________________                                        001            0.98                                                           002            0.9                                                            003            0.78                                                           004            0.72                                                           0.72           00                                                             005            0.69                                                           ______________________________________                                    

The arrangement described above may be incorporated in a network managerfor a mobile telephone network. Alternatively it may be provided as astand-alone arrangement which services a number of mobile networks.

We claim:
 1. Apparatus for the detection of fraudulent use of atelephone subscriber's instrument in a mobile telephone system, theapparatus including means for determining a long term calling profilefor a said subscriber, means for determining a short term callingprofile for the subscriber, means for determining the difference betweenthe long term and short term profiles, said difference comprising asubscriber profile pattern, and a trained neural net arrangement fordetermining from the subscriber profile pattern a probability value forthe existence of fraud in that pattern, wherein the neural netarrangement comprises a self organising map adapted to effect patternrecognition of said subscriber profile patterns, and a multilayerperceptron adapted to determine said probability value for eachrecognised pattern.
 2. Apparatus as claimed in claim 1, and includingtraining means for providing said multilayer perceptron with subscriberprofile patterns relating to predetermined frauds.
 3. Apparatus asclaimed in claim 1, wherein said long term and short term profilescomprise each a set of values determined for a respective set of callattributes.
 4. Apparatus as claimed in claim 3, and including means forselectively scaling the difference between the long term and short termprofiles whereby to accentuate the difference between the profiles for asubset of said attributes.
 5. Apparatus as claimed in claim 1 whereinsaid self organising map is arranged to group said subscriber profilepatterns into a plurality of groups such that similar patterns areplaced in the same group.
 6. Apparatus as claimed in claim 5, andincluding means for classifying said groups into types of legitimate useand fraudulent use.
 7. Apparatus for the detection of fraudulent use ofa telephone subscriber's instrument in a mobile telephone system, theapparatus including an input preprocessor, a neural network enginecoupled to the preprocessor, and an output postprocessor coupled to theneural network engine, wherein the preprocessor is adapted to determinefor each subscriber, from that subscriber's telephone call data, a firstlong term calling profile, a second short term calling profile, and asubscriber profile pattern comprising the difference between the firstand second profiles, each said calling profile and subscriber profilepattern comprising a set of values for a respective set of callattributes, wherein the neural network engine comprises a selforganising map trained to effect pattern recognition of said subscriberprofile patterns and a multilayer perceptron adapted to determine foreach recognised pattern a value indicative of the probability of a fraudbeing associated with that pattern, and wherein said postprocessor isarranged to order said recognised pattern according to said fraudprobabilities.
 8. A mobile telephone system provided with frauddetection apparatus as claimed in any one of claims 1 to
 7. 9. A methodfor the detection of fraudulent use of a telephone subscriber'sinstrument in a mobile telephone system, the method includingdetermining a long term calling profile for a said subscriber,determining a short term calling profile for the subscriber, determiningthe difference between the long term and short term profiles, saiddifference comprising a subscriber profile pattern, and processing thepattern via a trained neural net arrangement comprising a selforganising map adapted to effect pattern recognition of said subscriberprofile patterns and a multilayer perceptron adapted to determine saidprobability value for each recognised pattern whereby to determine fromthe subscriber profile pattern a probability value for the existence offraud in that pattern.
 10. A method as claimed in claim 9, wherein saidlong term and short term profiles comprise each a set of valuesdetermined for a respective set of call attributes.
 11. A method asclaimed in claim 10, wherein the differences between the values of thelong and short term profiles are selectively scaled whereby toaccentuate the difference between the profiles for a subset of saidattributes.